Police force

Subject Access Request to Hampshire and Isle of Wight Constabulary

What Hampshire and Isle of Wight Constabulary holds about you, where to send the request, and what to expect back.

GetMySAR is an independent service and is not affiliated with, endorsed by, or acting on behalf of Hampshire and Isle of Wight Constabulary. The contact details below are published so you can make a request yourself free of charge.

Where to send your request

Verified 30 August 2026

Postal address: Data Protection Officer Mottisfont Court Tower Street Winchester Hampshire SO23 8ZD
Their own SAR form: Open Hampshire and Isle of Wight Constabulary’s request form
ICO registration: Z4886192
ID they ask for: Hampshire and Isle of Wight Constabulary asks for two forms of identification — one proving who you are and one proving your current address — and says they must be in date, valid and not expired. For identity it accepts a passport (the pages carrying your photograph and personal details), a driving licence, a birth certificate or an adoption certificate. For address it accepts a utility bill (not a mobile phone bill), a bank or credit card statement, a landline telephone bill, a council tax bill, a driving licence not already used as proof of identity, or a letter from a job centre or from the Department for Work and Pensions, HM Revenue and Customs, the Ministry of Justice, the Home Office, UK Visas and Immigration, the Probation Service or a police force — dated within the last three months. Copies must be scanned or photocopied in colour, because the force says it does not accept black and white. If your request is for body-worn video footage, CCTV, a custody photograph or anything else that contains an image, the force says your proof of identity must be a passport or a photo driving licence, and that it will accept a student ID, company ID or National ID card from someone who holds neither. If you are applying on behalf of someone else, it asks for two forms of identification for both of you. If you apply by post, it asks you not to send originals, because they will not be returned.

Source: Hampshire and Isle of Wight Constabulary published information. Organisations change these details — tell us if this is out of date.

Specific to Hampshire and Isle of Wight Constabulary

The force you are asking is Hampshire and Isle of Wight Constabulary. Until recently it was Hampshire Constabulary, and both names are still in use on its own site: its pages and the Information Commissioner's register now say Hampshire and Isle of Wight Constabulary, while the web addresses of those same pages still say hampshire-constabulary and its legal department still calls itself Hampshire Constabulary Legal Department. Its data protection page calls it "the Hampshire Police". Any of those names will find the right force. It is one force covering Hampshire, Portsmouth, Southampton and the Isle of Wight — there is no separate Isle of Wight force, no separate Isle of Wight request route and no separate Isle of Wight address. Do not confuse it with Hampshire County Council, which is a different organisation with a different request route. The constabulary asks you to make the request through its own online form, and it is free. Its guidance also says a request can be made "by telephone, email, by post, or in person", and then publishes no telephone number for it anywhere and no email address on any of its request pages. If you would rather not use the form, write to the postal address above — our free letter template will draft the letter. There is no email address above because the force does not publish one for making a request. Its privacy notice offers public.access@hampshire.pnn.police.uk, on the older pnn.police.uk domain, for concerns about how your information has been handled, and its right of access section sends requests to the online form instead. The same mailbox is given as the Data Protection Officer's formal contact details in the force's live facial recognition privacy notice, and as a return address on a 2021 subject access form that no current page links to. It is the only data protection mailbox the force publishes. The force and the Information Commissioner's register disagree by one letter on the postcode. The force gives SO23 8ZD on all three of its own pages, including one published this month; its register entry gives SO23 8ND for the same building, with the street lines identical. The force's own version is the one above. Before you apply, the force will send you elsewhere for two things, and it is right to. A police certificate for a visa, emigration or residency abroad is ACRO Criminal Records Office, not this force. A criminal record check an employer has asked for is a DBS check — and it is a criminal offence for an employer to require you to make a subject access request instead. The force says so itself: "It is against the law for an employer, or potential employer, to ask you to perform a subject access request as a condition of your employment." Two things this route will not do. It will not give you information about another person — the force says "The subject access process is confidential between the applicant and the police. We cannot provide details of another person this way." And it will not produce disclosure for family court proceedings: the force says disclosure "cannot be made to members of the public involved in Family Court proceedings without an Order requiring that disclosure from the Family Court", asks for at least 28 days' notice of a court order date, and handles it through a different team at a different address. If you were in a road traffic collision and want the collision report, that is a separate, chargeable route and not a subject access request. The force's own page says the clock runs "from the date we receive your payment" and quotes 12 weeks, and the form it asks you to use is addressed to insurers and solicitors and gives the price of both options as "TBC". A subject access request for what the force holds about you is free, and it is the route open to you as an individual. Three different response times are published across three of the force's own pages: "one month (or three months in complex cases)" on the form's landing page; "We usually respond within 30 days. But it can take up to two months extra" on the rights page; and "normally within one month of receipt of your request unless an exemption from doing so can be lawfully applied" in the privacy notice. Thirty days is not a calendar month, and the legal position is one month, extendable by two more.

Making a request to a police force

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

What people commonly ask for

Incident and crime reports where you are named
Custody records and detention logs
Intelligence entries and markers held against you
Body-worn video and 999 or 101 call recordings
Records of stop and search encounters

Watch out for

Section 45(4) DPA 2018 lets a force restrict access where disclosure would obstruct an inquiry, prejudice the prevention or detection of crime, harm public security, or affect the rights and freedoms of other people. A restriction has to be necessary and proportionate for the specific information at issue — it is not a reason to refuse the request as a whole, and the ICO's guidance on restricting the right of access under Part 3 sets out the test a force is supposed to apply.
Ongoing investigations are the most common ground for withholding. Records may become disclosable once proceedings conclude, and a force can tell you when it is worth asking again.
A force can refuse to confirm or deny that it holds anything at all, where confirming would defeat the purpose of the restriction. That is a recognised answer rather than an administrative failure.
Two exemptions sit alongside those restrictions: legal professional privilege — in Scotland, confidentiality of communications — which covers legal advice the force has taken, and safeguarding national security.
If a force does withhold something, it must normally tell you within a month that it has done so and why, and tell you that you can complain to the force, complain to the ICO, or ask a court to enforce the right. Silence is not one of the options.
Body-worn video and CCTV often contain other identifiable people, so expect redaction or blurring rather than full disclosure. And the right reaches your own personal data only — section 45 entitles you to personal data concerning you — so it is not a route to a recording of someone else, or to footage of an incident you had no part in.
Records about someone who has died are not a subject access request — data protection rights end at death, and unlike health records there is no Access to Health Records Act equivalent for policing. ACRO points people to a Freedom of Information request to the force that dealt with the matter. That is a different law with different tests, and the duty of confidence survives death, so it is the right door rather than a guaranteed answer.
It is a criminal offence under section 184 of the Data Protection Act 2018 for an employer, or for anyone providing goods, facilities or services to the public, to require you to obtain your own police record through a subject access request as a condition. Schedule 18 defines the records this covers by the bodies that hold them, and a record of a conviction or caution obtained from a chief constable is one of them. A job, a tenancy or an insurance policy made conditional on you producing your record this way is the offence, not a formality.

Your rights, whoever you are asking

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.

Send it to Hampshire and Isle of Wight Constabulary

You can do this yourself for free using the details above. If you would rather not handle the wording, the submission and the chasing, GetMySAR prepares, sends and follows up your request for a fixed £20 fee.

Free letter template Have GetMySAR handle it — £20

This page is general information about your right of access under UK data protection law. It is not legal advice. If your situation is complex or contested, consider speaking to a solicitor or contacting the Information Commissioner’s Office.